The number of things on the Internet of Things is growing at an unfathomable rate. A thermostat, weather station, desk lamp, and car charger are devices designed to be as unobtrusive as possible. At the same time, we demand that they be knowledgeable about our daily lives and quickly respond to our daily wants and needs. As technology becomes more powerful and more pervasive, we don't spend much time thinking about security. It's a common misconception: security is for my passwords and my browser, so why does my electric meter need it? It is this type of gap in consideration that can undermine the usability of the things we use every day.
I recently built an interactive exhibit at a museum. In order to monitor the use and to know when maintenance was needed, I had the exhibit report of various interaction events to the Internet, where I could see and monitor it. Security is for my bank account; I didn't need to encrypt these messages! I simply needed to get my data from point A to point B, so I used a clear-text method for posting to a database. Who cares if a man-in-the-middle attack is possible? Who cares if someone does a replay attack and posts the same data twice to my database? If other people saw the data being passed back and forth, I figured I was doing something pretty cool because people generally don't care about event flags. This changed when I had a discussion with someone who had a reason to believe that the global temperature data was being modified for various political and financial reasons. It suddenly struck me that if we're going to make unbiased scientific decisions on (pick your societal ill), then we need data that we can rely on. Cryptography is not always about secrets; it's also about ensuring that you are having the conversation you want to have with the person you want to talk to.
We are riding on a wave of great creativity and exploration within physical computing that will increase the quality of our relationship with technology and our quality of life. Most people don't think of these devices as needing cryptography, but when left without thought, the Internet of Things can wreak more havoc than identity theft or wire fraud. This is not about spying, hackers, or rogue governments. If we can push technology towards a more secure means of communication, we ensure the freedom that modern society takes for granted. We should be laying the groundwork today for the future generation of hackers, makers, tinkerers, and innovators to create amazing things for sure—but we should be building this groundwork with security in mind.
Over the past few months, I have begun to learn about hashes, HMACs, and nonces. Cryptography is no longer restricted to the realm of applied math PhDs or government-funded researchers. It has been made approachable and stronger by a loose net of enthusiasts that take it upon themselves to be the quiet but persistent force of change. I encourage you to become an educated participant in the modern world of technology. Cryptography should not be simply seen as something to strengthen a project. Rather, we must reinforce a trend of secure communication so that future projects and technologies use proper encryption and cryptography without thinking about it.
Josh came to SparkFun as part of our Hacker-in-Residence program. We worked with him to build his vision—a module that would help fellow hackers secure their projects. I hope that you will find this book, which contains projects that combine electronics, software, and security, of interest. It will make you appreciate the challenge and necessity of securing our Internet of Things.
Nathan Seidle
CEO, SparkFun Electronics
